CVE-2026-80677

A flaw was found in the Linux kernel driver core. The dev_has_sync_state() function reads the dev->driver pointer multiple times without proper synchronization. This allows a concurrent unbind operation to clear the dev->driver pointer between reads. Such a race condition could lead to a null pointer dereference, potentially causing system instability or a denial of service.

A MODERATE severity race condition was found in the Linux kernel driver core. The dev_has_sync_state() function reads the dev->driver pointer twice without holding device_lock(): once for the NULL check and once to dereference ->sync_state. Some callers hold only device_links_write_lock, which does not prevent a concurrent device unbind from clearing dev->driver via device_unbind_cleanup() between the two reads, so the second read can observe NULL, causing a NULL pointer dereference that can crash the kernel (kernel panic) and result in a denial of service. Exploiting this race requires local access with privileges sufficient to trigger a device driver unbind; the flaw affects only availability, with no impact on confidentiality or integrity. All currently tracked Red Hat products, including Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel and kernel-rt components, are marked NOT AFFECTED because the vulnerable code is not present in the shipped versions of those products. The Red Hat severity of MODERATE (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is lower than the upstream CVE.org rating of IMPORTANT (CVSS 3.1 score 7.8), because the upstream score assumes high confidentiality and integrity impacts, whereas this flaw only impacts availability through a kernel panic.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.